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Abstract 

The method of decoy-state quantum key distribution (QKD) requests different intensities of light 
pulses. Existing theory has assumed exact control of intensities. Here we propose a simple protocol 
which is secure and efficient even there are errors in intensity control. In our protocol, decoy pulses 
and signal pulses are generated from the same father pulses with a two- value attenuation. Given the 
upper bound of fluctuation of the father pulses, our protocol is secure provided that the two-value 
attenuation is done exactly. We propose to use unbalanced beam-splitters for a stable attenuation. 
Given that the intensity error is bounded by ±5%, with the same key rate, our method can achieve 
a secure distance only 1 km shorter than that of an ideal protocol with exactly controlled source. 

PACS numbers: 03.67.Dd, 42.81. Gs, 03.67.Hk 
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, 3], y, ^, ^ where Alice randomly changes the intensity 
of her pulses among a few values (e.g., 3 values: 0, fi and fi') or infinite values and then 
she can verify the fraction of single-photon counts in the raw key. With this information, a 
secure final key can be distilled by using the separate theoretical resul ts |l6| . 

So far a number of experiments on decoy-state QKD have been done 
fiber or in free space, in polarization space or with phase-coding. However, the existing 
theory of decoy-state method assumes the exact control of pulse intensities. A problem met 
in practice is how to carry out the decoy-state method efficiently given the inexact control 
of pulse intensity. As we have shown 2P(], actually, one can verify the single-photon counts 
rather efficiently with simple tomography even though the intensity fiuctuations of each 
light pulses are large. However, doing it in that way Alice needs additional operation of 
tomography. Here we present a simpler protocol for decoy-state method QKD. 

Here we shall consider the effects of inexact control of /i, fi' in a decoy-state protocol 
requesting 3 intensities, {0,/i, fi'}. (Actually, all decoy-state protocols with a few intensities, 
e.g., 2 or 4 intensities [3|, l5| have the same basic problem of inexact control of /U, /i'.) For 
clarity, lets first consider an ideal protocol with exact intensity control, as shown in Fig. l:a). 
At any time t, if Alice wants to send a pulse of intensity fi or /i', she first produces a father 
pulse of intensity Q. After that she attenuates the pulse by A{t) = fi/Q or A{t) = fi'/Q 
randomly and a pulse of intensity fi or /i' is produced randomly and sent out to Bob. In 
this ideal protocol. Both Q and A{t) are controlled exactly. 

For practical use, we propose a similar protocol as shown in Fig. l:b). Alice wants to 
produce an intensity Q for the father pulse. She then takes the same random attenuations 
as that in the ideal protocol. Here we assume that Alice can control the attenuation factors 
of A{t) exactly (either fi/Q ot but she can not control Q exactly. ( To control the 

instantaneous attenuation A{t) exactly we can use unbalanced beam-splitters as we are going 
to show.) At each time, she has actually produced intensities of {^t} for the father pulses. 
Although we can never control the intensity exactly, by our currently existing technology, 
we can definitely control the intensity in a small range, say, e.g., controlling the fiuctuation 
within ±5% of Q. That is to say, Alice knows the upper-bound of {^It}- We denote such an 
upper bound value as Qm- 
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Given this upper-bound value flu, the set-up in Fig. l:b) is equivalent to a virtual set-up 
as shown in Fig. 2:a). In the virtual protocol shown in Fig. 2:a), every time a father pulse 
of constant intensity Qm is first produced and then the pulse is attenuated randomly, with 
attenuation factors of A'(t) = Alice cannot control this A'(t). After this attenuation, 
a pulse of intensity Qt is produced. Note that A'{t) is independent of /i, /i', since we can 
imagine that Alice decides to use /i or /i' after the attenuation A'{t). Since all attenuators 
are inside Ahce's Lab., it makes no difference if Ahce exchanges the order of attenuators 
A{t) and A'{t). The physical meaning of order exchange is that Alice first decides to use 
II or ij,' and then arrange the attenuation A'(t) which is independent of Alice's decision of 
using /i or fi'. This is just the virtual protocol in Fig. 2:b). In Fig. 2:b), after the pulse 
passes A(t) but before passes A'(t), the intensity should be either fi = f^^M or fl' = j^^m 
exactly. That is to say, during the virtual stage between A{t) and A'{t), the light intensities 
of each pulses are either exactly fl or exactly p,'. But after a pulse passes through A'{t), 
the intensity is changed to inexact values of /li or /i'^. For the security proof of the real 
set-up in Fig. l:b), we show the following lemma first. Lemma: The set-up in Fig. 2:b) 
is unconditionally secure if Alice regards it as a 3-intensity decoy-state protocol with each 
light intensities being randomly chosen from {0,/i, /i'}. 

Proof: First we suppose Eve controls A'{t). The dashed square can be regarded as an exact 
source for a decoy-state protocol using intensities 0, jl, jl'. As it has been known already, 
decoy-state method with exact intensity control is secure given whatever channel. Here what 
Eve can do is first using A'{t) for attenuation and then do whatever. This is only a type 
of specific channel therefore cannot be used to cheat Alice and Bob. In the set-up of Fig. 
2:b), actually the attenuator A'{t) is not controlled by Eve, definitely the set-up is secure 
because Eve cannot attack the protocol better with her power being reduced. Alternatively, 
we imagine that A'{t) is controlled by Alice's friend, Clare. If Alice choose to disregard 
Clare's existence then to Alice this is just a decoy-state protocol with exactly controlled 
intensities of fl, jl'. 

Given this lemma, we immediately have the theorem: The set-up shown in Fig. l:b) is 

unconditionally secure even though there are intensity fluctuations in values fi, fi' if: 1 ) the 
values of {Vtt} are upper-hounded by Qm! 2) attenuation A(t) is exactly controlled; 3) Alice 
assumes that she had used exact intensities o/ {0, /x^, //'^} in calculating the fraction of 
single-photon counts and distilling the final key. 
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The proof is simply that the final light pulses produced in Fig. l:b) and final light pulses 
produced in Fig. 2:b) are identical. While the scheme in Fig. 2:b) has been proven to be 
secure by our Lemma. 

The question remaining is then how to make stable attenuations A{t) used above. We 
can realize A{t) by beam-splitters as shown in Fig. ([3]). First, we attenuate each father pulses 
(Qt) by a fixed attenuation factor of Aq = (^o can be realized by an unbalanced beam- 

splitter.) Second, after this Aq attenuation, we split the beam by a /i : /x' beam-splitter and 
then either the transmitted beam b or the refiected beam b' will be blocked and the other 
one will be guided to the optical fiber and sent to Bob. 

Suppose the ideal protocol with parameters /ie,/ie would produce a good key rate in a 
certain experimental condition. Alice can try to use any intensities around fie, f^'e ^i-nd then 
assumes that she had used larger intensities for security. One good choice is that Alice tries 
to produce {0,/ie/A,/ig/A} with A = VIm/^ for quantum communication with Bob and then 
assumes to have used {0, /ig, fi'^}. For simplicity, we shall only consider this option hereafter. 
The actual efficiency of the protocol can be concluded by a real experiment. But we 

ly on what should be found if we did the 



can still roughly estimate the efficiency theoretical 
experiment. One can calculate the final key ratefs 



16( 1 if he knows fraction of single-photon 



counts and the quantum bit error rate (QBER). 

We consider the normal case where there is no Eve. and the channel transmittance is 
linear. We shall first compare the key rate of the following two protocols: our protocol with 
channel transmittance rj (protocol P{ri)) and the ideal protocol with channel transmittance 
rj/X (protocol Po{r]/X)). In both protocols they will assume exact values 0,/ie,/ie the 
calculation of single-photon counts and final key distillation. However, in protocol P{ri), 
Alice had done her best to produce 0,/ie/A,/ig/A for quantum communication. In both 
protocols, Alice and Bob can find the values of S^^ = 1 — e~'^^^^^ + cLb-, S^i^ = 1 — e"'"^^/^ + 
(Ib as the counting rates (yields) of pulses of intensities (or assumed intensities) of /ie,/ie, 
respectively, where (Ib is the dark count rate of Bob's detector. We have the following joint 
equations(2] to calculate the single-photon transmittance for both protocols: 

e-^'^so + fiee~^''si + csc = S^^; 
Here c = 1 — e~^'= — fie^'^"- Parameters of are counting rates for states from x 



4 



pulses (x = 0,1), Sc is the counting rates of state pc (state of those multi-photon pulses) 
from /ie pulses. Parameters s'^ are counting rates of the same state as defined for Sx, but 
they are for those states from /ig pulses only. The values of Sq, s'q can be deduced from the 
observed counting rate of those vacuum pulses. (For the two-intensity protocolj^), one can 
assume Sq = Sq = for the minimum key rate.) Asymptotically, = s'^, Sc = s'^. Given a 
finite number of pulses, Sx and s'^ can be a bit different but their possible range of difference 
can be bounded by classical statistics 0, y, [sl with exponential certainty therefore minimum 
values of Si, s[ can be calculated numerically. Since Si,s[ values for both protocols are 
calculated from the same equations with same parameters, the value of verified single-photon 
transmittance {si,s[) of our protocol P{ri) is equal to that of the ideal protocol Po{i]/X). 
This indicates that the two protocols should have the same fraction of single-photon counts 
for each intensity. 

We use notation E, E' for the observed error rates of pulses of intensity /Xg, /^e; respectively. 
If they are determined by dark counts, alignment error and transmission error, these values 
and the deduced value of single-photon QBER in our protocol should be the same with (or 
a bit less than) those of the ideal protocol Pq^tj/X). 

Given all these values requested for the final key distillation are the same for the two 
protocols, we conclude that that the key rate of our protocol P{ri) is the same with that of 
the ideal protocol PqItj/X). In the case that the intensity fluctuation is bounded by 5% in our 
protocol (i.e., A = 1.05) and the light intensity decreases by a half for every 15 kms in both 
protocols, the QKD distance of our protocol is only shorter than that of the ideal protocol 
by less than 1.06 km if we request the same key rate for two protocols. Similar calculation 



shows that even the maximum fluctuation is 20%, the shortened distance is 
This shows that the secure distance of currently existing experiments 18 



ess than 4 kms. 



19| would keep 



on exceeding 100 kms if they had used the proposed method here. Since currently existing 
experimental results jisl. Q have not adopted our protocol (producing different intensities 
from the same laser device with attenuation), it should be interesting to redo the decoy-state 
QKD experiment using our protocol for a securer result. 
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FIG. 1: a) The ideal protocol that Alice can produce constant intensity 17 for the father pulse 
therefore intensity /x, fi' are controlled exactly, b) The real protocol used in practice. At each time, 
Alice wants to produce intensity 17 for the father pulse, however, she actually produces {i^t} at 
each time t. Consequently, the intensities of output pulses are {fJ-i} , {/J-'j} ■ We assume that Alice 
can control the attenuator A{t) exactly in a real protocol. After a father pulse is produced, Alice 
randomly choose the attenuation factor by A{t) = fi/^l or A{t) = ^' /Vt. Here the subscript t is 
from 1 to + N' , subscript i for {/ij} is from 1 to N , subscript i for {fi'j} is from 1 to A^'. 
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FIG. 2: Equivalent virtual protocols. Our real protocol in Fig. l:b) is equivalent to a virtual 
protocol as shown in part a) of this figure. Here Alice first produces a constant intensity VLm for 
each father pulses and then attenuates each of them by attenuator A'{t). After A'{t), the pulse 
intensity is Of. It makes no difference to the output light if we exchange the order of A[t) and 
therefore a) is equivalent to b). In part b), we can also regard the dashed square as our 
source and A'{t) as part of the channel. 
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FIG. 3: Realizing A{t) by unbalanced beam-splitters. Aq : a constant attenuator with attenuation 
factor this can be realized by an unbalanced beam-splitter. BS: & fj, : fi' beam-splitter. OS: 

optical switcher. OF: optical fiber. 
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